URL Encoder / Decoder

About the URL Encoder / Decoder

A URL can only safely carry a limited set of characters: letters, digits, and a few punctuation marks. Everything else, including spaces, accented letters, emoji, and characters that have a special job in a web address such as ?, &, =, and #, has to be written as a percent sign followed by two hexadecimal digits. A space becomes %20, an ampersand becomes %26, and the letter e with an acute accent becomes %C3%A9. This tool converts text to that percent-encoded form and back again, so you can build a safe link or read an unreadable one.

The most important choice on the page is the scope. Component mode applies the rules for a single piece of a URL, such as one search term or one path segment, and escapes nearly everything, including slashes, question marks, ampersands, and equals signs. Full URL mode is meant for a whole address and leaves those structural characters alone, so https://example.com/a?b=c keeps its shape and only unsafe characters like spaces and accents are escaped. Picking the wrong one is the single most common reason a link breaks.

Developers building query strings, marketers assembling campaign links with long tracking values, support staff decoding a link a customer sent, and anyone debugging a redirect will use it. Encoding is not a security feature: it is a reversible formatting step, and anyone can decode the result. The sections below show how each mode behaves with real input, including the double-encoding trap and what a decode error looks like.

When to Use It

How to Use It, Step by Step

1. Choose the direction with the two buttons at the top left: Encode to turn readable text into percent-encoded form, or Decode to reverse it. The active button is highlighted.
2. Choose the scope with the buttons beside them: Component for a single value, such as one query parameter or one path piece, or Full URL for a complete address whose separators must stay in place. A one-line hint below the buttons describes the active choice.
3. Click into the large box, labeled "Text to encode" or "Text to decode" depending on the direction, and type or paste your text. The box starts with a sample web address.
4. Read the result in the lower panel labeled Result. It updates as you type or when you press a mode or scope button. The result panel can be blank until you type or toggle something the first time.
5. If the panel turns into a red message that the text cannot be decoded, look for a stray percent sign or a percent followed by something other than two hexadecimal digits, for example %zz, and correct it.
6. Use "Swap · use result as input" if you want to feed the output back in the opposite direction. It copies the result into the input box and flips between Encode and Decode, keeping your scope setting.
7. Press Copy above the result to put the output on your clipboard. Check it once more against the structure you expect, especially the characters : / ? & = and #, before pasting it into a link or code.

Understanding Your Results

Every encoded character is a percent sign and two hexadecimal digits that give a byte of the character's UTF-8 form. A simple ASCII character such as a space or ampersand is one byte, so one %XX group. Other characters take more bytes, which is why the e with acute accent produces %C3%A9 (two bytes) and a two-character word in Japanese produces six groups. The letters A-Z, a-z, digits, and the characters - _ . ! ~ * ' ( ) are left as they are in both modes.

In Component mode, all the other characters are encoded, so a value stays one unbreakable piece: : becomes %3A, / becomes %2F, ? becomes %3F, & becomes %26, = becomes %3D, + becomes %2B, and # becomes %23. In Full URL mode those characters, along with ; , @ $, remain, so the address can still be parsed. A quick check is to look for the characters you meant to keep. If a full address has lost its https:// or its question mark, you used the wrong scope.

Decoding mirrors this. Component decoding converts every valid %XX sequence back. Full URL decoding leaves sequences for reserved characters, such as %26, %2F, %3F, %23, and %3D, still encoded, because turning them into plain characters would change the meaning of the address. Decoding also does not turn a plus sign into a space; a plus remains a plus. Finally, if you encode text that already contains percent sequences, the percent signs themselves are encoded to %25, so %20 becomes %2520, the classic sign of double encoding.

More Worked Examples

Tips for Better Results

• Encode each query value separately in Component mode, then join the pieces with ? and & yourself. Encoding an entire assembled URL in Component mode escapes the separators and breaks the link.
• If a link looks double-encoded, with sequences like %2520 or %253A, decode it once and look again. Each decode pass removes a single layer of encoding.
• Plus signs need care. This tool encodes a space as %20 and does not convert a plus sign when decoding. If a link uses plus for spaces, as in HTML form submissions, replace each plus with a space yourself before decoding.
• When encoding a path with folder names, use Full URL for the entire path so the slashes stay, but encode a filename containing a slash or question mark on its own in Component mode.
• Check the very start of an encoded URL. If you see https%3A%2F%2F, the whole address was encoded as a component, which is right only if the address is meant to be inside another URL.
• For unreadable characters you cannot identify, decode the string and look at the result. A garbled mix of letters such as é usually means text that was encoded in the wrong character set earlier in the chain.

Common Mistakes to Avoid

• Encoding a complete URL in Component mode and then using it as a link. The colons and slashes are escaped, so browsers treat it as a relative path rather than an absolute address.
• Encoding a query value in Full URL mode. Ampersands, equals signs, and hash symbols are left alone, so a value like AT&T or C#, once placed in a URL, will be misread as separators.
• Encoding text twice. The percent sign is itself encoded the second time, producing %25 sequences that servers decode back only to the first layer of encoding.
• Expecting decode to work on any text containing a percent sign. A literal percent sign that is not followed by two hex digits, such as in 50% off, triggers the error. Encode it as %25 first.
• Treating percent-encoding as protection for sensitive data. Anyone can decode it in one step, so never use it to hide passwords, tokens, or personal information.

Assumptions and Limits

• The tool uses the browser's built-in encodeURIComponent, encodeURI, decodeURIComponent, and decodeURI functions. They follow RFC 3986 closely but have a few behaviors worth knowing, such as leaving the characters ! ' ( ) * unencoded in the component scope.
• Characters are converted to bytes using UTF-8. Data that was encoded in an older character set, such as Latin-1, may decode into the wrong letters or fail.
• Spaces are always encoded as %20. The plus-for-space convention used by HTML form submissions is not applied when encoding or decoding.
• The tool does not check whether a URL is real, reachable, or safe. Treat unfamiliar links with caution even after decoding them, and never paste secrets into a link.

Key Terms

Percent-encoding

A way to write a character as a percent sign followed by two hexadecimal digits for each byte. It is also called URL encoding.

Reserved character

A character with a special meaning inside a URL, such as ? to start a query, & to separate parameters, = to assign a value, and # to start a fragment.

Query string

The part of a URL after the question mark that carries name and value pairs, such as q=shoes&page=2, separated by ampersands.

UTF-8

The standard way of turning characters into bytes. English letters take one byte, accented letters usually two, and emoji four.

Double encoding

Encoding text that was already encoded, so each percent sign becomes %25. The result decodes back only to the first layer of encoding, not to the original.